CVE-2022-1789

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

Score

CVSS 3.1 6.8 Medium

Status

Modified - secalert@redhat.com

Published

2022-06-02

Last modified

2024-08-03

Weaknesses

CWE-476

Affected products

• Debian Linux (Debian)
• Fedora (Fedoraproject)
• Linux Kernel (Linux)
• Enterprise Linux (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1832397
• https://francozappa.github.io/about-bias/
• https://kb.cert.org/vuls/id/647177/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6JP355XFVAB33X4BNO3ER…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUOQTNTQ4ZCXHOCNKYIL2…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KCEAPIVPRTJHKPF2A2HVF5…
• https://www.debian.org/security/2022/dsa-5161